CVE-2022-33711

Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers to delete arbitrary directory using directory junction.

CVSS v3 5.5 MEDIUM
CVSS v2.0 2.1 LOW

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://security.samsungmobile.com/serviceWeb.smsb?year==2022&month=07	Vendor Advisory
https://security.samsungmobile.com/serviceWeb.smsb?year==2022&month=07	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:samsung:android_usb_driver:*:*:*:*:*:windows:*:*

History

No history.

Information

Published : 2022-07-12 14:15

Updated : 2024-11-21 07:08

NVD link : CVE-2022-33711

Mitre link : CVE-2022-33711

CVE.ORG link : CVE-2022-33711

JSON object : View

Products Affected

samsung

android_usb_driver

CWE

CWE-354

Improper Validation of Integrity Check Value

{"id": "CVE-2022-33711", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-07-12T14:15:18.450", "references": [{"url": "https://security.samsungmobile.com/serviceWeb.smsb?year==2022&month=07", "tags": ["Vendor Advisory"], "source": "mobile.security@samsung.com"}, {"url": "https://security.samsungmobile.com/serviceWeb.smsb?year==2022&month=07", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "mobile.security@samsung.com", "description": [{"lang": "en", "value": "CWE-354"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-354"}]}], "descriptions": [{"lang": "en", "value": "Improper validation of integrity check vulnerability in Samsung USB Driver Windows Installer for Mobile Phones prior to version 1.7.56.0 allows local attackers to delete arbitrary directory using directory junction."}, {"lang": "es", "value": "La vulnerabilidad de comprobaci\u00f3n inapropiada de la comprobaci\u00f3n de integridad en Samsung USB Driver Windows Installer for Mobile Phones versiones anteriores a 1.7.56.0, permite a atacantes locales eliminar un directorio arbitrario usando una uni\u00f3n de directorios"}], "lastModified": "2024-11-21T07:08:23.050", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samsung:android_usb_driver:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "374FCF5D-DE50-4CE7-89D9-0DCE6E74425B", "versionEndExcluding": "1.7.56.0"}], "operator": "OR"}]}], "sourceIdentifier": "mobile.security@samsung.com"}